Merge master into staging-next

doc/languages-frameworks/python.section.md

@@ -997,13 +997,18 @@ and in this case the `python3` interpreter is automatically used.
 
 ### Interpreters {#interpreters}
 
-Versions 2.7, 3.8, 3.9, 3.10 and 3.11 of the CPython interpreter are available
+| Package    | Aliases         | Interpreter |
-as respectively `python27`, `python38`, `python39`, `python310` and `python311`.
+|------------|-----------------|-------------|
-The aliases `python2` and `python3` correspond to respectively `python27` and
+| python27   | python2, python | CPython 2.7 |
-`python310`. The attribute `python` maps to `python2`. The PyPy interpreters
+| python38   |                 | CPython 3.8 |
-compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with
+| python39   |                 | CPython 3.9 |
-aliases `pypy2` mapping to `pypy27` and `pypy` mapping to `pypy2`. The Nix
+| python310  | python3         | CPython 3.10 |
-expressions for the interpreters can be found in
+| python311  |                 | CPython 3.11 |
+| python312  |                 | CPython 3.12 |
+| pypy27     | pypy2, pypy     | PyPy2.7 |
+| pypy39     | pypy3           | PyPy 3.9 |
+
+The Nix expressions for the interpreters can be found in
 `pkgs/development/interpreters/python`.
 
 All packages depending on any Python interpreter get appended

pkgs/applications/audio/sublime-music/default.nix

@@ -50,6 +50,9 @@ python.pkgs.buildPythonApplication rec {
   postPatch = ''
     sed -i "/--cov/d" setup.cfg
     sed -i "/--no-cov-on-fail/d" setup.cfg
+
+    # https://github.com/sublime-music/sublime-music/commit/f477659d24e372ed6654501deebad91ae4b0b51c
+    sed -i "s/python-mpv/mpv/g" pyproject.toml
   '';
 
   buildInputs = [

pkgs/applications/graphics/darktable/default.nix

@@ -58,12 +58,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.4.1";
+  version = "4.4.2";
   pname = "darktable";
 
   src = fetchurl {
     url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "e043d38d2e8adb67af7690b12b535a40e8ec7bea05cfa8684db8b21a626e0f0d";
+    sha256 = "c11d28434fdf2e9ce572b9b1f9bc4e64dcebf6148e25080b4c32eb51916cfa98";
   };
 
   nativeBuildInputs = [ cmake ninja llvm_13 pkg-config intltool perl desktop-file-utils wrapGAppsHook ];

pkgs/applications/misc/rofi-power-menu/default.nix

@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/jluttine/rofi-power-menu";
     maintainers = with maintainers; [ ikervagyok ];
     platforms = platforms.linux;
+    mainProgram = "rofi-power-menu";
   };
 }

pkgs/applications/networking/instant-messengers/element/pin.nix

@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.37";
+  "version" = "1.11.38";
   "hashes" = {
-    "desktopSrcHash" = "sha256-6YiMAmOb0lSaLDE/ohVpZFbl4J1NxS9xNFFcebVW9MA=";
+    "desktopSrcHash" = "sha256-xDeVwDQ0/ZeqA8c052WvDyhn14TgDTg+FRYQscgxXOQ=";
     "desktopYarnHash" = "1ksj99g649kvilr850rkk8nkl55z7vz7m8159777kjikakzra2ly";
-    "webSrcHash" = "sha256-zFRoL/bnic6Waaiz7Vfama4qzlYKk0TTr5zPK6PNSpM=";
+    "webSrcHash" = "sha256-R/JyEVjQN4AYD0AqLJDYcrfGHwTMVGDBhNIK3AtGi2c=";
-    "webYarnHash" = "1lpd9mmg51jnhdr2zfisxdpc4i64kn4bpzkxqzip7dnn9iz432kw";
+    "webYarnHash" = "1znayywxzs1c4ypdv4akxy0lb7mg0i9h74wnja4d5d3vbbdgnid5";
   };
 }

pkgs/applications/terminal-emulators/foot/default.nix

@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.15.2";
+  version = "1.15.3";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -90,7 +90,7 @@ let
 
   terminfoDir = "${placeholder "terminfo"}/share/terminfo";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "foot";
   inherit version;
 
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     owner = "dnkl";
     repo = "foot";
     rev = version;
-    hash = "sha256:1iz9l01fpryc335pb0c3qi67fmmfplizv5pbc9s578mxl5j9dxg4";
+    hash = "sha256-jn/S0xjxZPnkGYpTRIpL3dKxGe7+Z+EmOGHiE0UkQqg=";
   };
 
   depsBuildBuild = [

pkgs/applications/video/stremio/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    mainProgram = "stremio";
     description = "A modern media center that gives you the freedom to watch everything you want.";
     homepage = "https://www.stremio.com/";
     # (Server-side) web UI is closed source now, apparently they work on open-sourcing it.

pkgs/applications/virtualization/kraft/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, stdenv
+}:
+
+buildGoModule rec {
+  pname = "kraftkit";
+  version = "0.6.4";
+
+  src = fetchFromGitHub {
+    owner = "unikraft";
+    repo = "kraftkit";
+    rev = "v${version}";
+    hash = "sha256-+aZrJqxgPGIoWEW4PZj6Nib7Z49HitxqMbeoyIe14iM=";
+  };
+
+  vendorHash = "sha256-4V7GTqCDSHybuwIrnmO1MJ+DwMpkKOdA7UC72YJqStM=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X kraftkit.sh/internal/version.version=${version}"
+  ];
+
+  subPackages = [ "cmd/kraft" ];
+
+  meta = {
+    description = "Build and use highly customized and ultra-lightweight unikernel VMs";
+    homepage = "https://github.com/unikraft/kraftkit";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ dit7ya ];
+    mainProgram = "kraft";
+    broken = stdenv.isDarwin; # > machine/platform/iterator_v1alpha1.go:32:34: undefined: hostSupportedStrategies
+  };
+}

pkgs/applications/window-managers/eww/default.nix

@@ -43,6 +43,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/elkowar/eww";
     license = licenses.mit;
     maintainers = with maintainers; [ figsoda lom ];
+    mainProgram = "eww";
     broken = stdenv.isDarwin;
   };
 }

pkgs/data/fonts/cozette/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.22.0";
+  version = "1.22.1";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${builtins.replaceStrings ["."] ["-"] version}.zip";
-    hash = "sha256-IB+YQcIpxYumJ5ETezqQ2yVlvdh+wllJ+MkVHPWZCEg=";
+    hash = "sha256-HnMds58yv9Ck6ONRjdIm3CNpAi1E4Zei2MaxcMjp7FQ=";
   };
 
   installPhase = ''

pkgs/development/interpreters/risor/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "risor";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "risor-io";
     repo = "risor";
     rev = "v${version}";
-    hash = "sha256-CnwejQ6e08AaUshfieXbQx05G6ZoF6vDlrtai3qxrxo=";
+    hash = "sha256-YBiBadyI8TRa7CpiTkMOL0biuVMAk23sqEOzJ0ipfA8=";
   };
 
   vendorHash = "sha256-diAbQwnlhMm43ZlLKq3llMl9mO3sIkc80aCI5UDn7F4=";

pkgs/development/libraries/rdkafka/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rdkafka";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "confluentinc";
     repo = "librdkafka";
     rev = "v${version}";
-    sha256 = "sha256-MwPRnD/S8o1gG6RWq2tKxqdpGum4FB5K8bHPAvlKW10=";
+    sha256 = "sha256-v/FjnDg22ZNQHmrUsPvjaCs4UQ/RPAxQdg9i8k6ba/4=";
   };
 
   nativeBuildInputs = [ pkg-config python3 which ];

pkgs/development/python-modules/aiohomekit/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.6.13";
+  version = "2.6.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-33B9BBqvKQugGz4+9EuMPhLRyWd/Sbxwh4d5aMmDt4M=";
+    hash = "sha256-JPI1+sQVZe2/5YxW6OxZRosp36e93KEW+V1DAcLaYNY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/authlib/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "authlib";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "lepture";
     repo = "authlib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OYfvfPnpWE9g7L9cFXUD95B/9+OZy55ZVbmFhFgguUg=";
+    hash = "sha256-K6u590poZ9C3Uzi3a8k8aXMeSeRgn91e+p2PWYno3Y8=";
   };
 
   propagatedBuildInputs = [
@@ -49,6 +49,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [
     "authlib"
   ];
+
   disabledTestPaths = [
     # Django tests require a running instance
     "tests/django/"
@@ -60,7 +61,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for building OAuth and OpenID Connect servers";
     homepage = "https://github.com/lepture/authlib";
-    changelog = "https://github.com/lepture/authlib/releases/tag/v${version}";
+    changelog = "https://github.com/lepture/authlib/blob/v${version}/docs/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ flokli ];
   };

pkgs/development/python-modules/bytewax/default.nix

@@ -1,41 +1,47 @@
 { lib
 , stdenv
 , buildPythonPackage
+, cmake
+, confluent-kafka
+, cyrus_sasl
 , fetchFromGitHub
-, rustPlatform
-, setuptools-rust
 , openssl
 , pkg-config
-, cyrus_sasl
 , protobuf
-, cmake
-, gcc
-, confluent-kafka
 , pytestCheckHook
-, pythonAtLeast
+, pythonOlder
+, rustPlatform
+, setuptools-rust
 }:
 
 buildPythonPackage rec {
   pname = "bytewax";
-  version = "0.16.0";
+  version = "0.16.2";
   format = "pyproject";
 
-  disabled = pythonAtLeast "3.11";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "bytewax";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-XdFkFhN8Z15Zw5HZ2wmnNFoTzyRtIbB7TAtOpKwuKyY=";
+    hash = "sha256-PHjKEZMNhtLliOSGt4XHQFDm8Rc4TejQUVSqFN6Au38=";
+  };
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
   };
 
   # Remove docs tests, myst-docutils in nixpkgs is not compatible with package requirements.
   # Package uses old version.
   patches = [ ./remove-docs-test.patch ];
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.importCargoLock {
-    inherit src;
+    lockFile = ./Cargo.lock;
-    hash = "sha256-XGE1qPHi13/+8jjNCIgfzPudw561T0vUfJv5xnKySAg=";
+    outputHashes = {
+      "columnation-0.1.0" = "sha256-RAyZKR+sRmeWGh7QYPZnJgX9AtWqmca85HcABEFUgX8=";
+      "timely-0.12.0" = "sha256-sZuVLBDCXurIe38m4UAjEuFeh73VQ5Jawy+sr3U/HbI=";
+    };
   };
 
   nativeBuildInputs = [
@@ -53,18 +59,28 @@ buildPythonPackage rec {
     protobuf
   ];
 
+  passthru.optional-dependencies = {
+    kafka = [
+      confluent-kafka
+    ];
+  };
+
   preCheck = ''
     export PY_IGNORE_IMPORTMISMATCH=1
   '';
 
   checkInputs = [
     pytestCheckHook
-    confluent-kafka
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  pythonImportsCheck = [
+    "bytewax"
   ];
 
   meta = with lib; {
     description = "Python Stream Processing";
     homepage = "https://github.com/bytewax/bytewax";
+    changelog = "https://github.com/bytewax/bytewax/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ mslingsby kfollesdal ];
     # mismatched type expected u8, found i8

pkgs/development/python-modules/confluent-kafka/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "confluent-kafka";
-  version = "2.1.1";
+  version = "2.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "confluentinc";
     repo = "confluent-kafka-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xnbovQRvbhaYYXnssV0Jy+U9L6BUddIagbup2jdTugY=";
+    hash = "sha256-6CdalNFKkgF7JUqCGtt4nB1/H3u4SVqt9xCAg5DR3T0=";
   };
 
   buildInputs = [
@@ -62,6 +62,8 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/integration/"
+    "tests/test_Admin.py"
+    "tests/test_misc.py"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/publicsuffixlist/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20230804";
+  version = "0.10.0.20230806";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J8yeq9CuzXGlqPjGf8hnV0IeI+Wg0Q5GS69/8z+FLp8=";
+    hash = "sha256-jDDqegAZOG0UTKPbh1H3V+5GrMGU6m2WGesXUEFJHJY=";
   };
 
   passthru.optional-dependencies = {

pkgs/development/python-modules/versioneer/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "versioneer";
-  version = "0.28";
+  version = "0.29";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "python-versioneer";
     repo = "python-versioneer";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jy0c1I3kLgJAeGWzcgl5qVAWesf4EXaMIOW03B+1yWE=";
+    hash = "sha256-seYT/v691QB0LUzeI4MraegbNILU3tLO//9UbZIfe+A=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/yarn/default.nix

@@ -36,5 +36,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     license = licenses.bsd2;
     maintainers = with maintainers; [ offline screendriver marsam ];
     platforms = nodejs.meta.platforms;
+    mainProgram = "yarn";
   };
 })

pkgs/servers/pleroma/Revert-Config-Restrict-permissions-of-OTP-config.patch

@@ -0,0 +1,40 @@
+From 29af78b112f7956ac1211fbfec2eadbf4caca40f Mon Sep 17 00:00:00 2001
+From: Yaya <yaya@uwu.is>
+Date: Sun, 6 Aug 2023 00:02:40 +0000
+Subject: [PATCH] Revert "Config: Restrict permissions of OTP config file"
+
+This reverts commit 4befb3b1d02f32eb2c56f12e4684a7bb3167b0ee.
+
+The Nix store is world readable by design.
+---
+ lib/pleroma/config/release_runtime_provider.ex | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/lib/pleroma/config/release_runtime_provider.ex b/lib/pleroma/config/release_runtime_provider.ex
+index 9ec0f975e..91e5f1a54 100644
+--- a/lib/pleroma/config/release_runtime_provider.ex
++++ b/lib/pleroma/config/release_runtime_provider.ex
+@@ -20,20 +20,6 @@ def load(config, opts) do
+ 
+     with_runtime_config =
+       if File.exists?(config_path) do
+-        # <https://git.pleroma.social/pleroma/pleroma/-/issues/3135>
+-        %File.Stat{mode: mode} = File.lstat!(config_path)
+-
+-        if Bitwise.band(mode, 0o007) > 0 do
+-          raise "Configuration at #{config_path} has world-permissions, execute the following: chmod o= #{config_path}"
+-        end
+-
+-        if Bitwise.band(mode, 0o020) > 0 do
+-          raise "Configuration at #{config_path} has group-wise write permissions, execute the following: chmod g-w #{config_path}"
+-        end
+-
+-        # Note: Elixir doesn't provides a getuid(2)
+-        # so cannot forbid group-read only when config is owned by us
+-
+         runtime_config = Config.Reader.read!(config_path)
+ 
+         with_defaults
+-- 
+2.40.1
+

pkgs/servers/pleroma/default.nix

@@ -7,16 +7,20 @@
 
 beamPackages.mixRelease rec {
   pname = "pleroma";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitLab {
     domain = "git.pleroma.social";
     owner = "pleroma";
     repo = "pleroma";
     rev = "v${version}";
-    sha256 = "sha256-5qxop/hJj1hIsEcK6vJnI2RnAcLf3tO43B0e0FcNZcA=";
+    sha256 = "sha256-V/q6qpQkdrtMLzihV/0d3B+QUWwG4cYy8c2jNd5npww=";
   };
 
+  patches = [
+    ./Revert-Config-Restrict-permissions-of-OTP-config.patch
+  ];
+
   mixNixDeps = import ./mix.nix {
     inherit beamPackages lib;
     overrides = final: prev: {

pkgs/tools/misc/bonk/default.nix

@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bonk";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "elliot40404";
+    repo = "bonk";
+    rev = "v${version}";
+    hash = "sha256-Y6Hia+B7kIvdvpuZwWGJBsn+pOBmMynXai4KWkNs4ck=";
+  };
+
+  cargoHash = "sha256-XphSjB49zFB3zXYpdjjcVRdTAW2Bvg91aZkxDLvFy3M=";
+
+  meta = {
+    description = "The blazingly fast touch alternative written in Rust";
+    homepage = "https://github.com/elliot40404/bonk";
+    license = lib.licenses.mit;
+    mainProgram = "bonk";
+    maintainers = with lib.maintainers; [ dit7ya ];
+  };
+}

pkgs/tools/misc/zoxide/default.nix

@@ -44,5 +44,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/ajeetdsouza/zoxide/raw/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ ysndr cole-h SuperSandro2000 ];
+    mainProgram = "zoxide";
   };
 }

pkgs/tools/networking/iwgtk/default.nix

@@ -37,7 +37,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/j-lentz/iwgtk";
     changelog = "https://github.com/j-lentz/iwgtk/blob/v${version}/CHANGELOG";
     license = licenses.gpl3Only;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ figsoda ];
+    platforms = platforms.linux;
+    mainProgram = "iwgtk";
   };
 }

pkgs/tools/networking/openssh/default.nix

@@ -3,7 +3,6 @@ let
   common = opts: callPackage (import ./common.nix opts) { };
 in
 {
-
   openssh = common rec {
     pname = "openssh";
     version = "9.3p2";
@@ -59,12 +58,12 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "9.0p1";
+    version = "9.3p2";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      sha256 = "12m2f9czvgmi7akp7xah6y7mrrpi280a3ksk47iwr7hy2q1475q3";
+      sha256 = "sha256-IA6+FH9ss/EB/QzfngJEKvfdyimN/9n0VoeOfMrGdug=";
     };
 
     extraPatches = [
@@ -73,11 +72,10 @@ in
       (fetchpatch {
         name = "openssh-gssapi.patch";
         url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch";
-        sha256 = "sha256-VG7+2dfu09nvHWuSAB6sLGMmjRCDCysl/9FR1WSF21k=";
+        sha256 = "sha256-E36jxnPcu6RTyXXb9yVBCoFIVchiOSLX7L74ng1Dmao=";
       })
     ];
 
     extraNativeBuildInputs = [ autoreconfHook ];
-    extraMeta.knownVulnerabilities = [ "CVE-2023-28531" ];
   };
 }

pkgs/top-level/all-packages.nix

@@ -4359,6 +4359,8 @@ with pkgs;
 
   buildpack = callPackage ../development/tools/buildpack { };
 
+  bonk = callPackage ../tools/misc/bonk { };
+
   bottom-rs = callPackage ../tools/misc/bottom-rs { };
 
   bsp-layout = callPackage ../tools/misc/bsp-layout { };
@@ -32843,6 +32845,8 @@ with pkgs;
 
   krabby = callPackage ../applications/misc/krabby { };
 
+  kraft = callPackage ../applications/virtualization/kraft { };
+
   krane = callPackage ../applications/networking/cluster/krane { };
 
   krita = libsForQt5.callPackage ../applications/graphics/krita { };